ipa-server-certinstall command failed with the error "ScriptError: Peer's certificate issuer is not trusted (SEC_ERROR_UNKNOWN_ISSUER)"
Issue
Customer has a IPA server without the CA component installed.They are using CA certificate signed by an external certificate.
Currently customer is in the process of updating the new server certificate using "ipa-server-certinstall" commands however process is failing with the following error :
/usr/sbin/ipa-server-certinstall -v -d /root/ipa_cert_update/server.crt /root/server_private.key -p password --pin=pin
ScriptError: Peer's certificate issuer is not trusted ((SEC_ERROR_UNKNOWN_ISSUER) Peer's Certificate issuer is not recognized.). Please run ipa-cacert-manage install and ipa-certupdate to install the CA certificate.
ipa.ipaserver.install.ipa_server_certinstall.ServerCertInstall: ERROR: Peer's certificate issuer is not trusted ((SEC_ERROR_UNKNOWN_ISSUER) Peer's Certificate issuer is not recognized.). Please run ipa-cacert-manage install and ipa-certupdate to install the CA certificate.
Customer indicated one of the Intermediate CA certificates were renewed recently.
Environment
- Red Hat Enterprise Linux 7.5
- IPA server without the IPA CA component
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase of over 48,000 articles and solutions.
Close
Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.